Advisory · CVE-2026-80155
Lantern: unauthenticated authentication bypass in Lantronix web portal enables RCE
A path-truncation flaw in the web management portal of Lantronix out-of-band devices lets unauthenticated attackers bypass session checks, read sensitive config files, and upload files anywhere, leading to remote code execution. CVSS 10.0.
- Vendor
- Lantronix
- Product
- SLC8000 / EMG8500 / EMG7500 out-of-band devices
- Identifier / CWE
- CVE-2026-80155
CWE-22 - Action timing
- Immediate
Explain it like I’m five
A bouncer checks your name against a guest list kept in a filing cabinet. You hand him a name just the right length so the cabinet drawer slams shut on the wrong folder, and he ends up reading a folder that says everyone is allowed in.
- 01Web portal reached
An unauthenticated attacker reaches the web management portal upload endpoint.
- 02Cookie crafted
They supply a session cookie value of a precise length, so the firmware builds a session file path that truncates at the wrong delimiter.
- 03Path traversal
The truncated path is redirected to an arbitrary on-disk file such as the local user database, and session validation passes.
- 04Bypass to RCE
With checks bypassed, the attacker reads sensitive configuration files and uploads files to arbitrary filesystem locations, achieving remote code execution.
What happened
The Lantern disclosure (September 21, 2026) reports an unauthenticated authentication bypass in the web management portal upload endpoint of Lantronix autonomous out-of-band devices. The web configuration server builds the session cookie file path with snprintf into a fixed-size buffer; a cookie value of a specific length truncates the path at the required delimiter, and path traversal then redirects authentication validation to an arbitrary on-disk file such as the local user database. The result is unauthenticated read of sensitive configuration files and arbitrary file upload leading to remote code execution. Affected: SLC8000 before firmware 9.7.0.5, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. CVSS 10.0 (v3.1).
What to do
- Upgrade SLC8000 to firmware 9.7.0.5 or later and EMG8500/7500 to 9.7.0.1 or later immediately; this one needs no credentials.
- Do not expose the web management portal to the internet; restrict it to the OOB network behind VPN or jump hosts.
- Inspect web server logs for unusual cookie lengths and unexpected file uploads.
- Rotate device credentials and review configuration files, since unauthenticated config reads were possible.
Management note
A CVSS 10.0, unauthenticated, remote path from a web page to root on the box that consoles into your racks. This is the patch-first item in the whole cluster, and it argues for treating OOB web portals as exposed attack surface until proven otherwise.